SAFETY PROCESS HAZARD ANALYSIS TABLE OF CONTENTS 1. INTRODUCTION/PURPOSE SCOPE DEFINITIONS REQUIREMENTS...

Transcription

1 Page 1 of 15 TABLE OF CONTENTS 1. INTRODUCTION/PURPOSE SCOPE DEFINITIONS REQUIREMENTS RESPONSIBILITIES REFERENCES ATTACHMENTS APPENDICES Rev. Issue Date Amendment Description Prepared By: Reviewed By: Approved By: Included additional scope requirements for PHA initiated by MOCs. 1 1-Oct-12 Procedure updated to align with global OE procedures EHS-6205, EHS-6200 and EHS Revised to reflect current work process Jul-09 Document classification changed from policy to procedure, number is now Rev. 0. Next scheduled Periodic Review :October 2015 Venkata Chandra Roehl Bartolome Roehl Bartolome Carl Poldrack Page 1 of 15

2 Page 2 of INTRODUCTION/PURPOSE The OSHA PSM Standard and the OE system require the conduct of Process Hazards Analysis (PHA) to manage the process safety risks of operations. This procedure is intended to establish a consistent process for evaluating process hazards associated with facility operations. 2. SCOPE This procedure is applicable to the Q-Chem manufacturing facilities in Mesaieed and Ras Laffan. This procedure covers PHAs that have broad process coverage and are subject to periodic revalidation. This also covers single purpose PHAs such as those required by MOC and other work processes. 3. DEFINITIONS Cause-by-Cause HAZOP: a Hazard and Operability study in which there is an explicit correlation between the consequences, safeguards, and actions to each particular cause of a deviation. Complex PHA method: for the purpose of this procedure, the HAZOP/LOPA method. Consideration a method for risk reduction, required by EHS-6100 Risk Ranking Matrix, made by the PHA Team for management review and evaluation. Consequence: the undesirable result of an incident, usually measured in terms of health/safety effects, environmental impacts, loss of property, and business costs. Deviation-by-Deviation HAZOP: a Hazard and Operability study in which all causes, consequences, safeguards, and actions correlate to a deviation. Enabling Event: An event or condition that makes possible another event. Expected Outcomes reasonable consequences considering only those conditions explained in the cause description. Other failure conditions [such as event escalation (a leak continues to get worse), the probability that a toxic material is directed toward breathing space, the probability of use, or the probability of multiple personnel in the area] are not considered when determining consequences unless stated in the cause description and reflected in the cause frequency. Frequency: number of occurrences of an event per year. HAZOP-LOPA Analysis a scenario-based hazard evaluation procedure, in which a team uses a series of guide words to identify possible deviations from the intended design or operation of a process, then examines the potential consequences of the deviations and the adequacy of existing safeguards. Page 2 of 15

3 Page 3 of 15 The HAZOP-LOPA includes an analysis of each scenario using predefined values for the initiating cause frequency, independent protection layer failure probabilities, and consequence severity, in order to compare an order-of-magnitude scenario risk estimate to risk criteria. Hazard: an inherent chemical or physical characteristic that has the potential for causing harm to people, damage to property or the environment, and/or adverse impact or interruption to the normal flow of business. Initiating Event: The event, which initiates the scenario that is leading to the undesired consequence. It is referred as the initiating cause. Independent Protection Layer (IPL): A special class of protection layers that satisfy the following conditions: Independent from the initiating event and any other protection layers; Capable of being evaluated or validated for performance; Must reduce the frequency of the scenario by at least an order of magnitude; and Must completely prevent the scenario without the assistance of any other protection layer. Mitigated Risk: the risk of an event with consideration given to existing IPLs. Process Hazard Analysis (PHA): An organized and systematic effort to identify and analyze the significance of potential hazards associated with the processing or handling of highly hazardous chemicals by focusing on equipment, instrumentation, utilities, human actions, and external conditions that might affect the process. It includes some or all of the following activities: hazard identification, consequence analysis, hazard evaluation, past incident evaluation, human factors evaluation, facility siting evaluation, risk assessment, and development of recommendations. Residual Risk: The risk of an event with consideration given to existing IPLs and recommended actions. Safeguard: Any device, system, or action that is likely to interrupt the chain of events following an initiating event, or that mitigates the consequences of a hazardous event. A safeguard may not meet the requirements of an IPL. Severity: a measure of the magnitude of a consequence. Simple PHA Methodology: for the purpose of this procedure, What-If, Checklist, What-If/Checklist, and Failure Modes and Effects Analysis (FMEA) methodologies. Unmitigated Risk: the risk of an event without consideration given to existing safeguards. Page 3 of 15

4 Page 4 of REQUIREMENTS 4.1 Identifying PHA Categories There are two categories of PHAs. Broad Process: studies which cover large systems or entire process units. Single Purpose: studies which cover specific equipment or smaller sections of the process. Single purpose PHAs are generally required by MOC, incident investigations, or other work processes. 4.2 Selecting a PHA Method PHA methods may be classified as simple or complex. Simple methods shall be one of the following: What-If, Checklist, What-If/Checklist, or FMEA If a complex method is required, the method shall be HAZOP/LOPA. Specific requirements for the HAZOP/LOPA method are covered in the Global OE Procedure EHS 6200 Hazard and Operability Study with Layer of Protection Analysis The PHA method chosen shall be a method that is a scenario-based and single-failure type The selection of the PHA methodology shall consider the relative hazard and complexity of the process to be studied and the hazards of the materials in the process. If any two characteristics in below table indicate a complex method, a complex method shall be considered If one or less characteristic in below table indicates a complex method, a simple method may be considered. A PHA may use multiple methodologies in the same study depending on the processes covered. Characteristics for PHA Method Selection Characteristic Simple Method Complex Method Complexity of the process Simple/Small Complex/Large Type of process Utility Hydrocarbon/Chemical Type of operation Batch Continuous Toxic, Flammable, Corrosive, Physical, Explosive, Reactive, Nature of the hazard Asphyxiant Radioactive The PHA Facilitator shall determine the appropriate methodology and provide the reasoning behind the choice in the PHA documentation. The rationale for selecting the methodology used in the PHA shall be addressed in the PHA report. Page 4 of 15

5 Page 5 of Preparation for the PHA Broad-process PHAs shall be initiated and coordinated by the Process Safety and Compliance group Single-purpose PHAs shall be initiated and coordinated by a representative of the affected group (i.e. MOC facilitator, investigation coordinator, etc.) The initiator shall form the PHA team, compile process safety information and other associated documents, and develop a schedule for the study. 4.4 PHA Scope The process unit owner and the PHA facilitator shall define the scope of the study Physical boundaries of the PHA shall be identified on piping and instrumentation diagrams (P&IDs) or other drawings by designating a specific process connection or hand-over point that can be identified in the field. Marked drawings shall be maintained with the PHA report as part of the archive documentation. The PHA facilitator shall assure that no gaps exist between PHAs such that equipment or operations go unanalyzed Utilities and environmental control equipment connected to the process shall be included in the PHA boundaries unless a separate PHA covers the utilities and environmental control equipment At a minimum, the PHA shall consider impacts to workers, the public, the environment and economics. If a risk evaluation is to be performed, the PHA shall follow the guidance in EHS-6100 Risk Ranking Matrix If the process being studied is partially incomplete (e.g., incomplete vendor packages), those incomplete sections shall be excluded from the scope of the PHA and analyzed separately For PHAs which are initiated by MOC, the PHA team shall ensure that all possible scenarios or conditions are identified and included in the scope of the study. These include: Normal Operations Idle / Standby Conditions Batch Operations Precommissioning/Commissioning Operations Decommissioning/Shutdown Operations. 4.5 PHA Team Core Team. The process hazard analysis shall be performed by a Core Team. The core team shall consist of at least three (3) people. The combined experience of the Core Team shall be at least 20 years for simple PHA methods and at least 30 years for complex PHA methods. At a minimum, the Core Team shall have the following expertise: Page 5 of 15

6 Page 6 of 15 Methodology Experience. One member shall be trained in the PHA method being used. This person shall serve as the PHA Facilitator. Broad process PHAs shall be led by a facilitator certified as per the requirements of Global OE Procedure EHS-6206 (PHA Facilitator Competency Assessment). Facilitators for single purpose PHAs need not be certified to EHS-6206 requirements. Engineering. At least one person on the core team shall have an engineering degree and three (3) years of technical experience. The person with engineering experience shall have experience with the process being studied. Process Operations. At least one person on the core team shall have a minimum five (5) years experience with operating the process being studied or a similar process. The employee with process operations experience assigned to the PHA should have previous start-up, shutdown, emergency, and normal operating experience with the process. This role could be filled with an operator or a first-line supervisor. Where appropriate, it is recommended that an hourly employee be included in the PHA. It is preferable to have more than one operations representative. Process Experience. One person shall have experience in the process. The person shall have a thorough understanding of the process or supply chain operation. It is preferred that this person be from Research & Technology or from another plant with a similar process; however, this experience may be fulfilled by any person fulfilling the above three areas of expertise. Personnel fulfilling the expertise requirements for the PHA team must be present for the entire duration of the PHA. If personnel fulfilling the expertise requirements cannot meet, the PHA meeting must be postponed. The Core Team should remain constant throughout the PHA; it is not desirable to substitute personnel. However, in the rare case where substitution is necessary, allowance for stand-ins may be made with approval of the PHA facilitator, so long as the stand-in meets the minimum requirements of the role. Supplemental Team Members. Other discipline experts may be assigned to the PHA full time or part time as appropriate. However, the PHA Team should not exceed ten (10) members in the PHA session. Supplemental Team Members shall have experience with the process under review or similar process equipment. Page 6 of 15

7 Page 7 of 15 Examples of Supplemental Team Members include the following. Technical Representatives - i.e., a Mechanical Engineer, Civil Engineer, Electrical Engineer, and Instrument Engineer. These personnel may augment the team as appropriate. A Process Chemist with experience in the process being studied or similar processes. Equipment Inspectors. Maintenance and/or Instrument Technicians. Safety and/or Environmental Engineering Specialists. Process Automation Specialists. External experts from sister facilities or Research & Technology are encouraged in order to increase the effectiveness of the evaluation and to promote sharing of process safety information and strategies within the company. Scribe. In addition to the Core Team, the PHA team should include a scribe to record the PHA study. This scribe should be a separate person from those team members above and should not be included in the calculation of the team experience. 4.6 Process Safety Information (PSI) Process Safety Information (PSI) shall be available to the PHA team during the PHA on existing facilities and projects PSI relevant to the PHA shall be current and accurate PSI required includes the following. Hazards of the Chemicals Used or Produced by the Process Material Safety Data Sheets (MSDS) Corrosively data Hazardous effects of inadvertent mixing of materials that may occur Reactivity matrix Technology of the Process A block flow diagram or simplified process flow diagram Process chemistry Maximum intended inventory (normal maximum inventory) Safe upper and lower limits for such parameters as temperature, pressure, flows, levels, or compositions. Equipment in the Process Accurate P&IDs Page 7 of 15

8 Page 8 of 15 Plot plan of site Mass and energy balances Design codes and standards employed Safety systems (interlocks, detection, or suppression systems) Relief system design and design basis Ventilation system design Electrical classification Equipment design (capabilities/ capacities/ design temperature and pressure/ materials of construction) Additional Information Requirements Operating and maintenance procedures PSM incident and near miss investigation reports from the subject plant and other plants MOCs related to the process since the last PHA 4.7 Conducting the Study Initial Team Meeting A complete, team-based review of a facility s process hazards and risks includes several elements in addition to the use of one or more hazard evaluation methods. These elements include training in the methodology being performed (for those team individuals not familiar with the methodology) and an overview of the process (e.g., a review of the process chemistry and block flow diagram) A review of the methodology or methodologies chosen for the PHA shall be provided to all team members in order to prepare the team members for active participation in the PHA. A review of the risk analysis used to rank scenarios must be provided Knowledgeable personnel shall provide a process overview to the core team members. The process overview shall include a review of the process chemistry and hazardous materials, the flow of materials in the process (including a block flow diagram), the equipment, process controls, and safety systems Evaluation of Process Hazards The PHA team shall evaluate process hazards based upon the nature of the chemicals involved (toxicity, flammability, etc.), the process conditions (flow, temperature, pressure, composition), the team s experience, and information about previous incidents both in the facility and at other sites. Material safety data sheets (MSDSs) and similar information shall be used in understanding the potential effects specific process materials have on personnel; however, MSDSs alone do not always identify all of the pertinent hazards (e.g., properties of significant, potential contaminants). Page 8 of 15

9 Page 9 of Previous Incidents The PHA team shall evaluate the results of the incident investigations of previous PSM incidents. Previous incidents shall include incidents at the facility being analyzed, at similar CPChem facilities, and at other company facilities where information is available. The PHA Facilitator shall assure that all previous incidents identified are cross-referenced to specific scenarios in the PHA where that incident was analyzed Facility Siting Facility Siting shall be reviewed by the PHA team. The Facility Siting review shall be in two stages: (1) globally for the unit/site and (2) as part of the PHA scenario evaluation. The PHA team shall identify hazards caused by siting issues to equipment, building, and personnel locations and recommend ways to reduce the hazards. Detailed stand-alone facility checklists (such as those on the CPChem PSM Best Practices Network SharePoint site) and building siting studies may augment the global facility siting review Human Factors Human Factors shall be reviewed by the PHA team. The Human Factors review shall be in two stages: (1) globally for the unit/site and (2) as part of the PHA scenario evaluation. The PHA team shall identify hazards caused by human factor issues to equipment, building, and personnel locations and recommend ways to reduce the hazards. Detailed standalone facility checklists (such as those on the PSM Best Practices Network SharePoint site) may augment the global human factors review. Potential human errors shall be considered as causes of process upsets. The team shall estimate whether operators would have adequate time, information, and equipment to respond to deviations (i.e., to contribute to incident prevention and mitigation). Routine operating procedures and other non-routine procedures (e.g., startup, shutdown, emergency, and maintenance procedures) should be analyzed to uncover error-likely situations that could result in catastrophic consequences Causes Causes (what-if questions, scenario initiating events, etc.) represent the human and equipment failures and natural events that can result in offnormal process conditions. If the PHA methodology chosen is HAZOP/LOPA, the analysis shall use the cause-by-cause methodology rather than the deviation-by-deviation method Consequences The PHA team shall document the reasonable worst-case consequences for an identified accident initiating event. Worst-case consequences are Page 9 of 15

10 Page 10 of 15 those expected outcomes given existing safeguards fail. Worst-case consequences reflect only those conditions explained in the cause description. Other failure conditions [such as event escalation (a leak continues to get worse), the probability of use or the probability of multiple personnel in the area] shall not be considered when determining consequences unless stated in the cause description and reflected in the cause frequency. At a minimum, consequences shall include an evaluation of the expected impact to workers, the public, the environment, and economics. The consequences shall include a range of impacts and the corresponding severity. The PHA should also identify any significant security plan design basis changes or obvious vulnerabilities Risk Ranking The risk associated with the scenario is based on the frequency of the initiating event (cause) and the severity of the consequence. This can be derived through the Risk Ranking Matrix. Where Mitigated Risk level is 5, the PHA team shall do the following; Immediate site management notification and action required. Temporary risk reduction measures (Interim Compensating Measures) that will reduce the risk rank to 4 or less must be put in place immediately. Additional temporary risk reduction measures that will reduce the risk rank to below 4 must be put in place as soon as practicable. Permanent measures to reduce the risk rank to 2 or less must be implemented within a specified time approved by site management and the next higher level of management. Where Mitigated Risk level is 4, the PHA team shall do the following; Site management notification and action required. Temporary risk reduction measures (Interim Compensating Measures) that will reduce the risk rank to below 4 must be put in place as soon as practicable. Permanent measures to reduce the risk rank to 2 or less must be implemented within a specified time approved by site management and the next higher level of management Engineering and Administrative Controls The PHA team shall identify existing engineering and administrative controls, or safeguards, required to bring the risk associated with the scenario to a no-action level. These controls may include detection devices that provide early warning of releases, inventory minimization policies, fire protection systems, Page 10 of 15

11 Page 11 of 15 criteria for equipment spacing, pressure relief devices, and process instrumentation and interlocks. Engineering and administrative controls shall be treated as a system that includes sensing, logic, and final elements. For example, a high pressure alarm shall be considered as including pressure sensor, pressure transmitter, distributed control system (DCS), operator (when operator action is required), final element (e.g., control valve), and miscellaneous equipment (wiring, etc.) required to successfully respond to a high pressure deviation and bring the process to a safe condition. By definition, given the cause, failure of engineering and administrative controls will result in the consequences identified previously in the scenario Considerations Where the scenario (cause/consequence/existing safeguards combination) fails to meet risk criteria as specified in the EHS-6100 Risk Ranking Matrix, the PHA team shall identify the scenario for management attention and, where possible, suggest actions for management to consider that will reduce the risk to a no-action level. These considerations must either eliminate or reduce the likelihood of potential incidents or lessen the consequences associated with the scenario. In developing considerations, the PHA team should follow a hierarchy of strategies or approaches: 1. Eliminate or reduce the underlying hazard (inherently safer options) Eliminate (remove the hazard altogether) Substitute (replace a material with a less hazardous material) Abate (reduce the quantity of material stored, used, or generated) Attenuate (modify the process to operate at a lower energy state) Dilute (mix a hazardous material with a less hazardous one) 2. Eliminate or reduce the likely cause of the scenario (prevention) 3. Reduce the severity of consequences (mitigation) 4. Increase the number or effectiveness of safeguards (control/protection) NOTE: If the PHA Team has suggestions that are not required for risk reduction to meet corporate risk criteria, the Team shall maintain a list separate from the PHA. These suggestions shall be considered separately by appropriate members of the plant leadership team. Page 11 of 15

12 Page 12 of PHA Follow-up A record of the PHA shall be recorded in PHAPro software using the most current template available for the type of PHA performed. The final PHA file (recorded PHAPro template) shall be loaded onto the common corporate storage location within 45 days of the final PHA team meeting. For broad process PHAs, a report documenting the study shall be prepared for local management review within 90 days of the final PHA team meeting. The PHA report shall include the following information. The PHA scope and boundaries. The rationale for selecting the methodology used in the PHA. The dates of the PHA. The name of the process reviewed. The name of the location. A biographical sketch of the participants, including their title, location, PHA team role, and qualifications for filling that role. A list documenting considerations for management and the bases used by the PHA team to suggest process improvement. A list of mechanical integrity covered equipment (MICE) utilized as independent protection layers (IPLs). A list of procedures, routine activities, and other safeguards utilized as independent protection layers (IPLs). A list of the PSI available during the PHA, including drawings and revisions reviewed. The worksheets and checklists produced during the PHA. P&IDs marked to reflect PHA study nodes. As noted in the previous section, a list of suggestions not required for risk reduction (non-risk supported considerations) shall also be prepared. However, this does not need to be included in the PHA report. For single purpose PHAs, a copy of the worksheets, considerations, and other relevant forms shall be generated off the PHA Pro software and included in the documentation package of the corresponding MOC, incident investigation, or other process requiring the study. A formal report is not necessary unless specifically required. Page 12 of 15

13 Page 13 of Management Review As soon as possible following the final PHA team meeting, the PHA facilitator shall review the considerations from the PHA with the plant leadership team so that they can assess the need for any immediate actions. The leadership team, and affected members of their respective work groups, shall review the considerations and prepare action plans within 60 days of the PHA report issue date. This review shall determine appropriate responses before turning the considerations into action items and beginning the action item tracking process. Appropriate responses shall include one of the following; Accept the consideration as is. Reject the consideration because the analysis upon which the consideration is based contains material factual errors (e.g., additional safeguards were not considered, calculations were incorrect, the facility or operation was not accurately represented in the PHA, etc.). Reject the consideration because the consideration is not necessary to protect the health and safety of the employees or contractors, or to protect the public or the environment from offsite effects. Reject the consideration because an alternative measure would provide a sufficient level of protection. Reject the consideration because the consideration is infeasible. The results of the management review shall be documented and reviewed by the PHA team as available. Non-risk supported considerations shall be evaluated and reviewed by the Production Manager and the Superintendent of the affected process unit Action Items Following management review, accepted considerations, or alternatives shall become action items. Management shall assign primary responsibility for action items and establish due dates. The Action Item Prioritization Matrix in the Compliance Assurance Program (QC-OEM-PRO ) may be used to estimate due dates. Page 13 of 15

14 Page 14 of 15 All PHA action items shall be tracked until closure and reviewed monthly by management. The status of these action items shall be reported through the process safety metrics. Action items from non-risk supported considerations should also be included in the review. However, these items shall not be included in the process safety metrics. Management shall communicate the actions to operating, maintenance and other employees whose work assignments are in the process and who may be affected by the recommendations or actions Document Retention PHA documentation, including documented resolution of recommendations, shall be retained for the life of the process PHA Revalidation At least every five (5) years, PHAs shall be revalidated to produce an updated PHA that adequately identifies, evaluates, and proposes controls for hazards of a process. There are three options for revalidation. Update and Revalidate This is the expedient, incremental approach where very little has changed in the process between the previous and the current PHA. In this option, the previous PHA is updated to reflect changes, incidents, and any new learning. For a process that has experienced no changes or incidents, it may only be necessary to affirm the continued validity of the previous PHA. Retrofit, Update and Revalidate This option reflects one or more reparable defects in the previous PHA. The sections containing the defects are revised and the PHA can be updated using the process above. Redo A redo is a complete restart of the previous PHA, working from a blank analysis. There are five basic reasons that could drive a total re-do of a PHA: Poor PHA quality. Multiple serious incident history with root causes that were not previously addressed in the PHA. Multiple significant changes since last PHA. Page 14 of 15

15 Page 15 of 15 Length of time (> 5 years) since last total redo. (The revalidation option must be a redo if the previous PHA was not a redo. A revalidation shall not be revalidated.) Opportunity to develop/maintain in-house PHA facilitation expertise. For the redo option, PHA quality shall be determined as less than desired if any of the following are true. The PHA method used in the previous PHA method was inappropriate for the complexity of the process studied. A liberal sampling of the hazard scenarios recorded indicate that: 1. Significant potential safety hazards were not identified. 2. Consequences were documented with inconsistency, promoting misunderstanding. Marked-up drawings that were used in the previous PHA did not accurately represent the field installation. Attachment A-PHA Revalidation Evaluation further assists in determining revalidation alternative for previous PHAs. 5. RESPONSIBILITIES Responsibilities are addressed in the appropriate sections of this procedure. 6. REFERENCES OSHA 29 CFR (e) Process Safety Management of Highly Hazardous Chemicals Process Hazard Analysis CPChem Global OE Procedure EHS-6205 Process Hazards Analysis CPChem Global OE Procedure EHS-6200 Hazard and Operability Study with Layer of Protection Analysis CPChem Global OE Procedure EHS-6100 Risk Ranking Matrix CPChem Global OE Procedure EHS-6206 PHA Facilitator Competency Assessment 7. ATTACHMENTS None 8. APPENDICES None Page 15 of 15